C4000

The Apple C1 Modem is the baseband chipset used in the iPhone 16e.

It is also known as C4000 in firmware.

The BasebandGoldCert ID is 4.

Known Firmware Versions

iOS

Baseband	Version	Build
1.01.10	18.3	22D8063
1.01.13	18.3.1	22D8075
1.01.14	18.3.2	22D8082
1.02.06-1	18.4 beta 2	22E5216h
1.02.09-4	18.4 beta 3	22E5222f
1.02.15	18.4 beta 4	22E5232a
1.02.17	18.4 RC	22E239

Firmware format

The firmware for the modem is shipped as a FTAB file in the iOS IPSW.

The segments are:

Tag	Size	Description
ARC2	6 bytes	Literally contains the string empty.
bver	63 bytes	Version string. For example 223.2256080003000000.2019|22.3.0.0|BBFW:1.01.13|date:2025 2 17
ARC1	401KB	Magic number 0xfeedcafe.
CAR2	470KB	Magic number 0xfeedcafe.
CAR3	469KB	Magic number 0xfeedcafe.
ibdt	272 bytes	iBootData
l1c2	6.0KB	Entirely 0x00 bytes.
rcpi	2.8KB	contains list of sha384 hashes of the other sections.
apmu	6.7KB	armv7/thumb code, baseaddr = 0x20004000
pmfw	10KB	arm/thumb code, baseaddr = 0x20000000
illb	526KB	iBoot/LLB bootloader, arm64 code, baseaddr = 0x4603C000
cdpd	15MB	arm64 code, has 'fwsg' segment list at the end of the file
cdph	965KB	armv7/thumb code, has 'fwsg' segment list at the end of the file
cdpu	18MB	arm64, has 'fwsg' segment list at the end of the file
l1cs	67MB	arm64, has 'fwsg' segment list at the end of the file
rkos	69MB	arm64, has 'fwsg' segment list at the end of the file
GNS1	460KB	Code for ARCv2 architecture. has strings with Compiler: DesignWare ARC C/C++ Compiler O-2018.06.
CR03	357KB	lzfse-compressed.
CR11	86KB
CR17	87KB
CR22	64KB
CR24	87KB
CR28	64KB
CR29	64KB
CR33	64KB
CR34	64KB
R104	554KB
R112	547KB
R118	589KB
R123	550KB
R125	588KB
R129	631KB
R130	630KB
R134	627KB
R135	627KB
R203	15KB
R204	121KB
RP03	47KB
RP11	18KB
RP17	36KB
RP22	143KB
RP24	36KB
RP28	81KB
RP29	39KB
RP33	39KB
RP34	39KB

Segments marked as "lzfse-compressed" have the following header, in little-endian:

u32 id;
u32 decompressed_length;
u32 compressed_length;
u8[compressed_length] lzfse_data;

The "id" field is different on each file.

The uncompressed data starts with:

u32 id;
u32 magic;

The "id" field matches the one in the compression header. The "magic" field depends on the segment:

CR??: 0x00000000
R1??: 0xdeadc101
R2??: 0xdeadc201
RP??: 0xdeadc301

1. 1. fwsg

Some binaries have the fwsg format, an IDA loader can be found here: https://github.com/nlitsme/AppleC4000